Unpatched SQLi in dameng100 muucmf 1.9.5.20260309: Remote Exploit Available

The National Vulnerability Database has disclosed CVE-2026-6562, a high-severity SQL injection vulnerability in dameng100 muucmf version 1.9.5.20260309. This flaw resides in the getListByPage function within the /index/Search/index.html file, allowing remote attackers to manipulate the keyword argument and execute arbitrary SQL queries.

This isn’t a theoretical issue; an exploit has been publicly released, making it a clear and present danger for organizations running the affected software. The vendor, dameng100, was reportedly contacted prior to disclosure but has not responded, leaving users exposed with no official patch in sight. The CVSS score of 7.3 (High) reflects the severity: it’s remotely exploitable, requires no authentication, and can lead to significant impact on confidentiality, integrity, and availability.

Defenders must recognize the attacker’s calculus here: publicly available exploits for unpatched vulnerabilities are low-hanging fruit. Attackers will scan for these systems, knowing they can likely achieve immediate impact. The lack of vendor response means organizations cannot wait for a patch; immediate mitigation or removal of the affected component is critical.